CVE Vulnerability Catalog

Wykryto krytyczną podatność w GNU Binutils 2.43, dotyczącą funkcji bfd_elf_reloc_symbol_deleted_p w pliku bfd/elflink.c komponentu ld. Manipulacja tą funkcją prowadzi do uszkodzenia pamięci.

The faraday-http-cache library acts as a shared cache by default (shared_cache: true). The ByUrl strategy keys entries on method and URL and treats a cached response without a Vary header as matching every request, while the ByVary strategy relies on the origin listing Authorization in Vary. A response to a request... (description truncated) may be improperly served to other users.

A vulnerability has been identified in the Linux kernel affecting the media: solo6x10 component. The issue was a lack of checks to ensure that the chip_id does not exceed the allowed range.

A vulnerability has been identified in the Linux kernel related to the initialization of subdevice before setting controls in the ov5647 module. The issue arises because the v4l2_get_subdevdata function is called before its initialization, which may lead to malfunction.

A vulnerability has been identified in the Linux kernel related to resource leaks during early registration failures. A recent commit fixed most cases, but for some reason, it left out the first error path, which still leaks resources.

A vulnerability related to the tile info buffer size in the AV1 module for Verisilicon has been fixed in the Linux kernel. The issue involved incorrect memory allocation for tile information, which could lead to operational errors.

A vulnerability in the Linux kernel related to RDS connections lacking a proper shortcut in case of connection errors has been resolved.

A vulnerability in the Linux kernel related to exception handling in SCSI for UFS has been resolved. The issue was the lack of proper flushing of exception handling work during system suspend when the runtime power management level is set to zero.

A vulnerability in the Linux kernel related to out-of-bounds access in the vfe_isr_reg_update() function has been resolved. The issue occurs during iteration in the vfe_isr() function, where an incorrect loop bound is used, potentially leading to unauthorized memory access.

A vulnerability has been identified in the Linux kernel that has been resolved. In the tw9906_probe() function, there was a potential memory leak because memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() was not freed.

A vulnerability has been identified in the Linux kernel related to a regmap leak on probe failure. The allocated mmio regmap is never freed, which can lead to memory issues.

A vulnerability related to out-of-bounds array access in the ntb_hw_switchtec module has been fixed in the Linux kernel. The patch protects against invalid index access to mw_sizes, which could lead to unexpected system behavior.

A vulnerability related to use-after-free in drm_crtc_commit after release has been fixed in the Linux kernel. The issue involved improper duplication of the drm_plane_state in the atmel_hlcdc_plane_atomic_duplicate_state() function.

In the Linux kernel, a vulnerability related to use-after-free bugs has been fixed, which occurs during the detachment of the FarSync T-series card. These issues may arise in the fst_remove_one() function, where fst_card_info is deallocated, but fst_tx_task or fst_int_task may still be active.

A vulnerability in the Linux kernel related to improper management of the reconnect-pending bit in the net/rds module has been resolved. The issue occurs when canceling the reconnect worker if it has not been scheduled beforehand.

A vulnerability has been identified in the Linux kernel that has been resolved in the TMU driver. The issue was that the TMU device could be used as both a clocksource and a clockevent provider, and the driver improperly managed the device's power.

A vulnerability in the Linux kernel related to the rio_scan_alloc_net() function has been resolved. In case of idtab allocation failure, memory is released using kfree() instead of rio_free_net().

A vulnerability in the Linux kernel related to event handler initialization in IPMB has been resolved, which does not use I2C reads but requires a value to be set. Otherwise, an I2C read will return an uninitialized value from the bus driver.

A vulnerability in the Linux kernel has been fixed that could lead to a null-pointer dereference in the jdi_panel_dsi_remove() function. The issue occurred when the jdi pointer was NULL, potentially causing unexpected system behavior.

A vulnerability has been identified in the Linux kernel related to the sticky mode in the SQ manager. This issue can lead to stalls when multiple SQs share an SMQ and transmit concurrently.